Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2023, 10:33
Static task
static1
Behavioral task
behavioral1
Sample
d92e6b60eecc9c96a1ad74e2d5c9ccba.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d92e6b60eecc9c96a1ad74e2d5c9ccba.exe
Resource
win10v2004-20231215-en
General
-
Target
d92e6b60eecc9c96a1ad74e2d5c9ccba.exe
-
Size
2.3MB
-
MD5
d92e6b60eecc9c96a1ad74e2d5c9ccba
-
SHA1
d7fcb40fa9a63dfaef531600da64c135d3079bd2
-
SHA256
8efce4180ae0e0f3c75dd2e13e44288c4352223f4b556c43bbb5cb96f8aec3ee
-
SHA512
ef9430611ea5b79108481cfa80961c569f0e2df82503afedff382f4f9bb0ed8227687a46b1c4e14af5692d81031b17c0c2bdb19bfac59cc59f3c3b099a332f37
-
SSDEEP
24576:FD+2lLAnMrJAmvGlBla8SmYU05za8oq9xKG+K/jAnKeL5qTZBHR1k85onek0nn15:FLuMNdGddGxsKrAEZZR1KneNBL2NuW
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
resource yara_rule behavioral2/memory/4768-7-0x0000000002DD0000-0x0000000002E48000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-11-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-21-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-43-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-67-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-71-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-69-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-65-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-63-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-61-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-59-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-57-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-55-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-53-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-51-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-49-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-47-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-45-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-41-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-39-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-37-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-35-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-33-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-31-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-29-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-27-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-25-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-23-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-19-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-17-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-15-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-13-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-9-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-8-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation d92e6b60eecc9c96a1ad74e2d5c9ccba.exe -
Executes dropped EXE 1 IoCs
pid Process 1328 RegAsm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Users\\Admin\\AppData\\Roaming\\Programs\\Steam.exe\"" d92e6b60eecc9c96a1ad74e2d5c9ccba.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 1328 RegAsm.exe 1328 RegAsm.exe 1328 RegAsm.exe 1328 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4768 set thread context of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings d92e6b60eecc9c96a1ad74e2d5c9ccba.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 3872 powershell.exe 3872 powershell.exe 3872 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe Token: SeDebugPrivilege 3872 powershell.exe Token: SeShutdownPrivilege 1328 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1328 RegAsm.exe 1328 RegAsm.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4768 wrote to memory of 4864 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 101 PID 4768 wrote to memory of 4864 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 101 PID 4768 wrote to memory of 4864 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 101 PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 102 PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 102 PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 102 PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 102 PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 102 PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 102 PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 102 PID 4864 wrote to memory of 3872 4864 WScript.exe 104 PID 4864 wrote to memory of 3872 4864 WScript.exe 104 PID 4864 wrote to memory of 3872 4864 WScript.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d92e6b60eecc9c96a1ad74e2d5c9ccba.exe"C:\Users\Admin\AppData\Local\Temp\d92e6b60eecc9c96a1ad74e2d5c9ccba.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Rbtqvuqexxqqfvkdqsvr.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Programs\Steam.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1328
-